HIPAA in the Age of COVID-19 – In February, the Department of Health and Human Services issued guidance reminding covered entities and health care providers of their HIPAA privacy obligations. Because a group health plan is a "covered entity" for this purpose, the plan cannot generally share information with the plan sponsor/employer about who, for example, is getting tested or what the results of the test may be.
While there are exceptions for the use and disclosure of protected health information (or PHI) for public health activity reasons, these exceptions do not generally cover disclosure to the employer. The closest permitted disclosure, as discussed in the HHS guidance, involves disclosure by a covered entity (plan or health care provider) to: (1) public health authorities; and (2) individuals at risk of contracting or spreading the disease but only if the disclosure is authorized by other (for example state) law for the general purpose of preventing or controlling the spread of the disease. Any such disclosure remains subject to the "minimum necessary" standard.
As a practical matter, we believe individual specific information is getting out in one of two ways. First, those who are testing positive are either voluntarily disclosing directly to employers or they are providing to their health care provider a HIPAA authorization that allows for disclosure. More general privacy rules would still apply and care should still be taken to limit further disclosure to a need-to-know basis. On this latter point, the CDC website includes the following notes:
- Employees who are well but who have a sick family member at home with COVID-19 should notify their supervisor and refer to CDC guidance for how to conduct a risk assessment of their potential exposure.
- If an employee is confirmed to have COVID-19, employers should inform fellow employees of their possible exposure to COVID-19 in the workplace but maintain confidentiality as required by the Americans with Disabilities Act (ADA). Employees exposed to a co-worker with confirmed COVID-19 should refer to CDC guidance for how to conduct a risk assessment of their potential exposure.
Second, when positive results are disclosed to local or federal health authorities, we believe those authorities will likely reach out to an employer for assistance in coordinating a response.
Note that H.R. 6201, the Families First Coronavirus Response Act, passed by the U.S. House of Representatives in the wee hours of Saturday morning, does not alter this analysis.
Coverage for Testing and Treatment of COVID-19 – Many states have been mandating that insurers cover testing (and in some cases treatment) costs without cost-sharing, such as deductibles, copayments and coinsurance. (See, for example, guidance from the Massachusetts Division of Insurance). While state insurance mandates are not applicable to self-insured group health plans, plan sponsors can always agree to absorb such costs. If it becomes law, the Families First Coronavirus Response Act would bar all group health plans and health insurers (whether offering group or individual health insurance products) from imposing cost sharing, prior authorization or similar requirements for testing (and related costs). The bill also explicitly extends this requirement to group health plans that have been “grandfathered” under the Affordable Care Act (Obamacare). Note, however, that the bill would not mandate coverage of the cost of treatment, as some states have done for insurance products.
One question that came up was whether no cost coverage of COVID-19 testing (and/or treatment) could cause the "high deductible health plan" (HDHP) product, whether fully insured or self-insured, to run afoul of technical requirements provided in the Internal Revenue Code. As a reminder, unless an individual has coverage under a qualifying HDHP that satisfies various requirements, tax-favored contributions cannot be made to a health savings account.
In Notice 2020-15, the IRS put this concern to rest by stating that “all medical care services received and items purchased associated with testing for and treatment of COVID-19 that are provided by a health plan without a deductible, or with a deductible below the minimum annual deductible otherwise required . . . . will be disregarded for purposes of determining the status of the plan as an HDHP.”